Cybersecurity for oilpatch services in northern Alberta.

The single most important shift for oilpatch service companies in the last two years has not been a new attack vector — it has been the contract requirement. Oil majors now embed cybersecurity attestations in prequalification packages. Service-company audits include questions about MFA enforcement, EDR deployment, backup configuration, vendor risk management, and incident response procedures. Companies that cannot answer these questions credibly are getting cut from approved vendor lists. The threat is no longer just “you get breached”. It is “you lose the contract”.

Beyond that, the attack patterns mirror the rest of the SMB landscape with a few sector-specific twists. Business email compromise targets payables — fuel, tubular goods, chemical suppliers — where invoice values are large and payment cycles are predictable. Site-trailer networks are often flat, unsegmented, and sit on whichever cellular or Starlink link is available; one compromised laptop on a remote lease can quietly reach the office tenant when the user comes home.

Contract-worker access is the under-recognized issue. Seasonal labour cycles mean people come on and off the platform every few weeks. Shared logins are common. Offboarding is irregular. We have seen environments where former hands still had access to the office Microsoft 365 tenant a year after their last shift — sometimes because of an oversight, sometimes because the only login into a vendor portal was shared across the crew and no one wanted to break it.

Ransomware against oilpatch services tends to hit during turnaround or shoulder season when the office staff is thin and the operational tempo is high. The cost of being unable to invoice, submit AER data, or respond to a customer request for the duration of an incident is rarely below five figures and often well into six.

Three structural reasons. First, service companies sit one or two hops up the supply chain from major operators, which makes them attractive as a pivot — a compromised service-company tenant can be used to phish into the customer organization. Second, payables are high-value and routine, which is the ideal cover for banking-change fraud. Third, the operational tempo and seasonal workforce make consistent access control genuinely difficult, and attackers know which corners get cut when the rig is moving.

We start with the documentation question — what your largest customer is actually going to ask on the next prequalification round — and work backwards from there. Managed EDR (Huntress) on every office and field endpoint. Microsoft 365 baseline with enforced MFA, conditional access, legacy authentication blocked, mailbox auditing enabled. Cloud backup separate from M365 retention. These are the controls oil-major questionnaires actually ask about, and they are the same controls that defend against the underlying threats.

For site-trailer connectivity we design the network so the trailer LAN is segmented from the office tenant, EDR runs through intermittent links, and a compromised tablet on a remote lease does not become a quiet foothold into your billing system. We standardize on per-person M365 accounts for contract workers, build the offboarding workflow into your safety paperwork, and audit access on a defined cadence so dormant accounts get caught before they become an entry point.

For AER data submission and regulatory recordkeeping, we make sure the generating systems are backed up to immutable storage with retention that outlasts your audit risk window. We do not write your environmental program or your operations procedures. We do make sure that a ransomware event does not also become a regulatory incident because the records are gone.